D.C. Circuit Court Issues Dangerous Decision for Cybersecurity: Ethiopia is Free to Spy on Americans in Their Own Homes

The United States Court of Appeals for the District of Columbia Circuit today heldthat foreign governments are free to spy on, injure, or even kill Americans in their own homes--so long as they do so by remote control. The decision comes in a case called Kidane v. Ethiopia, which we filed in February 2014.

Our client, who goes by the pseudonym Mr. Kidane, is a U.S. citizen who was born in Ethiopia and has lived here for over 30 years. In 2012 through 2013, his family home computer was attacked by malware that captured and then sent his every keystroke and Skype call to a server controlled by the Ethiopian government, likely in response to his political activity in favor of democratic reforms in Ethiopia. In a stunningly dangerous decision today, the D.C. Circuit ruled that Mr. Kidane had no legal remedy against Ethiopia for this attack, despite the fact that he was wiretapped at home in Maryland. The court held that, because the Ethiopian government hatched its plan in Ethiopia and its agents launched the attack that occurred in Maryland from outside the U.S., a law called the Foreign Sovereign Immunities Act (FSIA) prevented U.S. courts from even hearing the case.

The decision is extremely dangerous for cybersecurity. Under it, you have no recourse under law if a foreign government that hacks into your car and drives it off the road, targets you for a drone strike, or even sends a virus to your pacemaker, as long as the government planned the attack on foreign soil. It flies in the face of the idea that Americans should always be safe in their homes, and that safety should continue even if they speak out against foreign government activity abroad.

Factual background

Mr. Kidane discovered traces of state-sponsored malware called FinSpy, a sophisticated spyware product which its maker claims is sold exclusively to governments and law enforcement, on his laptop at his home in suburban Maryland. A forensic examination of his computer showed that the Ethiopian government had been recording Mr. Kidane’s Skype calls, as well as monitoring his (and his family’s) web and email usage. The spyware was launched when Kidane opened an attachment in an email. The spying began at his home in Maryland.

The spyware then reported everything it captured back to a command and control server in Ethiopia, owned and controlled by the Ethiopian government. The infection was active from October 2012 through March 2013, and was stopped just days after researchers at the University of Toronto’s Citizen Lab released a report exposing Ethiopia's use of FinSpy. The report specifically referenced the very IP address of the Ethiopian government server responsible for the command and control of the spyware on Mr. Kidane’s laptop.

We strenuously disagree with the D.C. Circuit’s opinion in this case. Foreign governments should not be immune from suit for injuring Americans in their own homes and Americans should be as safe from remote controlled, malware, or robot attacks as they are from human agents. The FSIA does not require the courts to close their doors to Americans who are attacked, and the court’s strained reading of the law is just wrong. Worse still, according to the court, so long as the foreign government formed even the smallest bit of its tortious intent abroad, it’s immune from suit. We are evaluating our options for challenging this ruling.

Related Updates

The first season of FX’s drama Feud told the story of the rivalry between Bette Davis and Joan Crawford. Set in Hollywood during the early sixties, the drama portrays numerous real-life figures from the era. Catherine Zeta-Jones appeared as Olivia de Havilland. Unfortunately, de Havilland did not enjoy the...

Social media platforms are avenues for typical Americans—those without enough money to purchase expensive television or radio ads—to make their voices part of the national political dialogue. But with news that a Russian company with ties to the Kremlin maintained hundreds of Twitter accounts and purchased $100,000 worth of ...

As Congress considers passing an Internet censorship bill in the name of fighting sex trafficking, groups that work closely with trafficking victims have been warning Congress that the bill could put trafficking victims in even more danger. It’s essential that lawmakers listen to those groups before passing a law that...

UPDATE: EFF joined coalition comments on October 18, 2017 in opposition to the A-File notice. The U.S. Department of Homeland Security (DHS) last month issued a notice that it is storing social media information on immigrants, including lawful permanent residents and naturalized U.S. citizens, apparently indefinitely, in a...

%3Ciframe%20src%3D%22https%3A%2F%2Fwww.youtube.com%2Fembed%2FDyxD260Wz2Y%3Fautoplay%3D1%22%20allowfullscreen%3D%22%22%20width%3D%22560%22%20height%3D%22315%22%20frameborder%3D%220%22%3E%3C%2Fiframe%3E Privacy info. This embed will serve content from youtube.com -- 9:07 a.m.: The hearing ends on a positive note, with multiple members of the committee expressing a desire to address sex trafficking in a way that preserves the protections for online speech in Section...

On October 1, a referendum will be held on whether Catalonia, an autonomous region of the northeast of Spain, should declare itself to be an independent country. The Spanish government has ruled the referendum illegal, and is taking action on a number of fronts to shut it down and...

%3Ciframe%20src%3D%22https%3A%2F%2Fwww.senate.gov%2Fisvp%2F%3Ftype%3Dlive%26amp%3Bcomm%3Dcommerce%26amp%3Bfilename%3Dcommerce091917%26amp%3Bstt%3D00%3A30%3A20%26amp%3Bauto_play%3Dfalse%26amp%3Bwmode%3Dopaque%22%20width%3D%22400%22%20height%3D%22300%22%20frameborder%3D%220%22%3E%3C%2Fiframe%3E Privacy info. This embed will serve content from senate.gov10:00 a.m.: In closing the hearing, Sen. Dan Sullivan speaks passionately about the need for the Department of Justice to invest more resources in prosecuting sex traffickers. Ms. Slater of the Internet Assocation echoes Sen...

The U.S. Department of Justice has come to the obvious conclusion that there’s no need to order Facebook to keep an investigation “secret” when it was never secret in the first place. While we applaud the government’s about-face, we question why they ever took such a ridiculous position in the...